Does Devin train on your data?
NoCognition · Coding
By default it can. On the consumer tier Devin uses your inputs to improve models unless you opt out. Its business tier typically does not.
What we checked
This assessment separates the consumer product from any business plan. It uses the vendor documents linked below; an unverified item is not a pass.
- Default data training
- Opt-out required
- By default Cognition may use non-Enterprise data for model training; toggle off in Devin's Data Controls settings (also enables Zero Data Retention). On the Team plan only admins can toggle it.
- Business-tier training
- No by default
- Enterprise customers are never trained on without express prior written consent.
- Training control
- Confirmed
- Cognition documents a training control. Confirm whether it is enabled centrally or must be set by each user.
Practical risk: Devin holds SOC 2 Type II and ISO 27001:2022 with a downloadable DPA and dated all-US subprocessor list. But non-Enterprise customers are opted into model training by default and must turn it off, and there is no EU residency or confirmed BAA.
How to make a decision
Check the precise account tier, written contract and intended data before approving Devin. A security certification, DPA or setting can apply to only part of a vendor's service. Keep the source links with your supplier review and revisit them when the vendor changes its terms.
More on Devin
Is Devin HIPAA compliant?Is Devin GDPR compliant?Is Devin SOC 2 compliant?Is Devin ISO 27001 certified?
See the full Devin risk profile, with every data-handling fact and its source, or browse all rated AI tools.